Create the Stage 5 Cloud Run Simulation Entry service

[anth-volk]

Goal

Introduce the Stage 5 simulation control-plane boundary as a separately deployable, authenticated Cloud Run service named policyengine-simulation-entry.

Scope

• preserve the existing simulation submit, poll, version, and ping contracts;
• proxy to the existing authenticated Modal gateway while retaining original job IDs;
• add caller and backend M2M authentication, startup safety checks, observability, and backend attribution;
• deploy no-traffic staging and production candidates through the existing gcloud/GitHub Actions conventions;
• keep all traffic promotion manual;
• publish the generated simulation client from the exact successfully qualified deployment SHA;
• run deployed authentication checks as separate CI/CD jobs.

Acceptance criteria

• normal, contract, lint, typing, and container checks pass;
• deployed candidates reject missing/invalid credentials and accept a valid M2M caller without launching probe simulation work;
• GitHub Actions cannot change Cloud Run traffic percentages;
• the old Modal gateway remains available as the Stage 5 backend and rollback target.